validation-suite-mcp

# FabTally Valid — MCP server

A developer **validation suite** — the per-call utilities incumbents charge for
(Vatstack $0.01–0.09/call) or lock behind subscriptions, unified. Fronts the
Valid HTTP API at **https://valid.fabtally.com**. Holds no private key.

## Tools (all paid; a call with no payment returns the decoded x402 402 challenge)

| Tool | Price | What it does |
|------|-------|--------------|
| `validate_vat` | $0.003 | **Flagship.** EU/EEA VAT: `{country_code, vat_number}` → per-country format + checksum pre-check AND a **live VIES lookup**, returning valid/registered plus the registered company name & address when VIES has them (cached ~1h to shield the flaky VIES). |
| `validate_iban` | $0.001 | `{iban}` → ISO 13616 length + **mod-97 checksum**, country, human-formatted grouping, and bank identifier (German Bankleitzahl, UK bank code + sort code, …) extracted from the BBAN where derivable. Pure-offline. |
| `validate_email` | $0.002 | `{email}` → RFC-ish syntax + **live MX-record (DNS)** existence + **disposable/throwaway-domain** detection (bundled blocklist) + role-address flag (`info@`, `admin@`). Stateless & non-PII: the address is never stored and no SMTP mailbox is probed. |
| `geo_lookup` | $0.002 | `{query:"Munich, Bavaria, Germany"}` or `{country,state,city}` → normalized names, **ISO 3166-1/-2 codes**, country→subdivision→city hierarchy, population and coordinates, over a bundled open dataset (no per-day API limits). |
| `decode_vin` | $0.002 | `{vin}` → 17-char format + North-American **check-digit** validation and a full **NHTSA vPIC** decode: make, model, year, body class, engine, plant country. VIN-only (never plate→owner). |

Every tool also accepts an optional `x_payment` (base64 x402 payload) that is
forwarded as the `X-PAYMENT` header to settle the call and return the real result.
Humans can instead prepay by card and use an `X-FabTally-Key` credit key against
the HTTP API.

## Transports

- **stdio** (portable): `npx fabtally-valid-mcp` (bin: `fabtally-valid-mcp`)
- **streamable-http** (hosted): `https://valid.fabtally.com/mcp`

Config: `FABTALLY_VALID_BASE` (default `https://valid.fabtally.com`).

Read-only, keyless, stateless, non-PII. Operated by Sunstone Soft
(fabtally.com). Not legal, tax, or financial advice.